ezEmu – Simple Execution Of Commands For Defensive Tuning/Research

KitPloit – PenTest Tools!–

ezEmu enables users to test adversary behaviors via various execution techniques. Sort of like an “offensive framework for blue teamers“, ezEmu does not have any networking/C2 capabilities and rather focuses on creating local test telemetry.

See /Linux for ELF
ezEmu is compiled as parent.exe to simplify process trees, and will track (and also kill) child processes to enable easy searches in logs/dashboards.
Current execution techniques include:

  • Cmd.exe (T1059.003)
  • PowerShell (T1059.001)
  • Unmanaged PowerShell (T1059.001)
  • CreateProcess() API (T1106)
  • WinExec() API (T1106)
  • ShellExecute (T1106)
  • Windows Management Instrumentation (T1047)
  • VBScript (T1059.005)
  • Windows Fiber
  • WMIC XSL Script/Squiblytwo (T1220)
  • Microsoft Word VBA Macro (T1059)
  • Python (T1059.006)

Note: You need to enable some macro related trust center settings for the Word stuffz to work – https://support.office.com/en-us/article/enable-or-disable-macros-in-office-files-12b036fd-d140-4e74-b45e-16fed1a7e5c6. You also need Python installed and the PATH variable set for #12

ezEmu is an interactive terminal application and works much better if you run from cmd.exe

Compile with reference to a few local DLL dependencies
(ex: csc /r:Microsoft.Office.Interop.Word.dll,Microsoft.Vbe.Interop.dll,System.Management.Automation.dll parent.cs)

This started as just simple personal research/putzing and is definitely not intended to be “clean code” (this is very much Jamie-code™️). That said, I am happy to accept issues and further suggestions!
TODO: Log output file (perhaps), more CTI + learning >> more execution techniques (always)

Copyright 2020 The MITRE Corporation
Approved for Public Release; Distribution Unlimited. Case Number 20-1357.
Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License. You may obtain a copy of the License at
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
The author’s affiliation with The MITRE Corporation is provided for identification purposes only, and is not intended to convey or imply MITRE’s concurrence with, or support for, the positions, opinions or view points expressed by the author.

View original article on KitPloit – PenTest Tools!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s